Reporting a data breach to the AP: deadline and when to report

You report a data breach within 72 hours of becoming aware of it to the Autoriteit Persoonsgegevens (Dutch Data Protection Authority, AP), unless it is unlikely to pose a risk to the people whose data is involved. If the risk is high, you also inform those people yourself. This is set out in articles 33 and 34 of the AVG (Algemene Verordening Gegevensbescherming, General Data Protection Regulation) . You report only via the reporting form of the AP . You cannot report by phone, email or letter.

You record every data breach in an internal breach register, including breaches you do not need to report. Within ISO 27701, this is part of your incident procedure, which links to the broader handling of security incidents. Below you can read when to report, how the 72 hours work and how to keep a register.

What is a data breach?

A data breach is a security incident in which personal data is lost, changed, or reaches someone who should not have access to it. The AP distinguishes three types.

Type	What happens	Example
Confidentiality	Unauthorised people see or get the data	Email with a client list sent to the wrong address
Integrity	The data is changed without authorisation	A hacker changes bank account numbers
Availability	The data is temporarily or permanently gone	Ransomware encrypts the customer database

According to the AP , an employee who looks at a medical file without a reason is also a data breach. So is a lost USB stick with unencrypted data.

When must you report a data breach, and when not?

You report to the AP, unless it is unlikely that the breach poses a risk to the people concerned. You inform those people yourself if the risk is likely to be high. For health data, criminal data, BSN (Dutch citizen service number) with name and address details, or copies of identity documents, the AP assumes a high risk.

Situation	Report to AP?	Inform data subjects?
Email with the name and email address of one client to a regular supplier, who confirms deletion	Probably not	No
Encrypted laptop stolen, key not leaked	Probably not	No
Unencrypted laptop with personnel files stolen	Yes	Yes, if the content is sensitive
Phishing: attacker had a week of access to a mailbox with client data	Yes	Depends on the content
Ransomware on the patient system, no backup available	Yes	Yes
Employee views files of acquaintances without a treatment relationship	Yes	Usually yes

Not sure? Use the AP’s factors: the nature of the breach, the sensitivity and quantity of the data, how easily people can be identified, the severity of the consequences, who the recipient is, and how many people are affected. Always record your reasoning, even if you decide not to report.

How does the 72-hour deadline work?

The 72 hours start when you become aware of the breach. That is the moment you can reasonably be sure that an incident has affected personal data. A suspicion is not yet awareness, but you must investigate straight away. Weekends and holidays count too.

Fictional timeline example. A consultancy with 30 staff discovers a phishing attack.

Moment	What happens
Friday 16:00	An employee reports a strange forwarding rule in her mailbox
Friday 17:30	IT blocks the account and sees that 400 emails were forwarded to an external address
Friday 18:00	The emails contain quotes with names and phone numbers, and two copies of passports. Awareness: the 72 hours start
Saturday 11:00	Risk assessment: identity documents leaked, so high risk for two people
Sunday 14:00	Report to the AP via the form; reference number saved
Monday 10:00	The two data subjects receive a letter with advice; breach register updated
Week after	Follow-up report with the outcome of the forensic investigation

If you do not have all the information after 72 hours, still submit a preliminary report. You can add details later. Reporting late can lead to a fine: in 2021 the AP fined Booking.com €475,000 because a breach was reported late.

What must a processor do?

As a processor, you do not report a breach to the AP yourself, unless your client has authorised you to do so in writing. You inform the controller “without undue delay” (article 33(2)). The client remains legally responsible for reporting on time.

So agree a concrete reporting deadline in the processing agreement, for example 24 hours. If a processor reports on behalf of several clients, the AP says it must make a separate report for each client, with a copy of the authorisation.

Step-by-step plan for a data breach

Get an overview

What happened, since when, which data, how many people, and who had access? Was the data encrypted?

Stop the breach and limit the damage

Block accounts, wipe a device remotely, take a file offline, or ask a wrong recipient to delete it.

Assess and report

Decide whether you need to report to the AP and whether you inform data subjects. Report within 72 hours of becoming aware.

Register and learn

Add the breach to your breach register, even if you do not report it. Discuss the cause and take measures.

Example: breach register (template)

Article 33(5) of the AVG requires you to document all data breaches: the facts, the consequences and the measures taken. You can copy these columns.

No.	Date of awareness	What happened	Data and number of data subjects	Risk	Reported to AP	Data subjects informed	Measures
2026-07	4 Sep 2026	Quote emailed to the wrong client	Name, address, 1 person	Low: the known recipient deleted it	No, reasoning recorded	No	Email autocomplete switched off
2026-08	18 Sep 2026	Phishing, mailbox forwarded	Contact details of 140 people, 2 passport copies	High for 2 people	Yes, reference number recorded	Yes, 2 people	MFA mandatory, training

Data breaches and ISO 27701

ISO 27701 requires a procedure for incidents involving personal data, including the assessment of whether a report is needed. In the ISO 27701 audit, the auditor checks whether the procedure exists, whether it has been tested, and whether the register is complete. An empty register after a year often raises more questions than a register with small leaks.

Do you work in healthcare? Then a data breach almost always involves health data. Also read AVG and NEN 7510 on the reporting duty in healthcare.

Frequently asked questions about reporting a data breach

Can I change or withdraw a breach report?

Yes. With the reference number, you can add to, amend or withdraw a report. So keep that number safe, because you can no longer view a submitted report online.

Will I get a response from the AP to my report?

Usually not. The AP may ask questions or start an investigation. You see an acknowledgement on screen straight after sending.

Can I report the breach to our functionaris gegevensbescherming (data protection officer)?

No, a report to your functionaris gegevensbescherming (FG) does not count as a report to the AP. Do involve the FG in handling the breach, for example when informing data subjects.